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We give an achievable secret key rate of a binary modulated continuous variable quantum key 
distribution schemes in the collective attack scenario considering quantum channels that impose 
arbitrary noise on the exchanged signals. Bob performs homodyne measurements on the received 
states and the two honest parties employ a reverse reconciliation procedure in the classical post- 
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I. INTRODUCTION 



Quantum key distribution (QKD) is a way to estabhsh 
a key between two communicating parties, traditionally 
called Alice and Bob, which is provable secure against 
any eavesdropping strategy of an technologically unlim- 
ited third party Eve. In principle, Alice and Bob can 
achieve this goal by exchanging nonorthogonal quantum 
states as signals and using non-commuting measurements 
on the receiver side. Any eavesdropper needs to interact 
with these quantum signals to gain information about 
the sent signal. This inevitably causes a disturbance of 
the signals and leads to errors in the data that Alice and 
Bob observe. If the amount of errors lies below a cer- 
tain threshold, Alice and Bob proceed by post-processing 
their data: they correct for errors and employ privacy 
amplification to cut out any residual information that 
Eve might have with the raw key. In this article, we 
give a lower bound to the secret key rate of a continuous 
variable (CV) QKD scheme [l|, 0, 0, S] employing homo- 
dyne detection in the collective attack scenario. As the 
outcomes of Bob's measurement are continuous, it is con- 
venient to characterize Eve's interference with the signal 
states by the first and second moments of Bob's mea- 
surement outcomes. These parameters are usually given 
in terms of the observed loss and the excess noise of the 
quantum channel connecting Alice and Bob. The proof 
technique presented here can be used to compute secret 
key rates of a binary modulated CV-QKD scheme for ar- 
bitrary, in particular non-Gaussian observations, thereby 
extending the results given in [3] . This is important from 
a conceptual point of view, as the optimality of Gaussian 
attacks [a, Q has only been shown for CV-schemes us- 
inga Gaussian modulated set of coherent states as input 
[1, 0, @|- So far, the security of the binary scheme is not 
fully established yet, even if one limits the eavesdrop- 



per to collective attacks. Our analysis presented here is 
restricted to the asymptotic key limit as the number of 
exchanged signals n approaches infinity. 

We consider the class of collective attacks [3, [lO| . 
thereby limiting Eve's possible interaction with the sig- 
nal states. In this scenario. Eve can only interact with 
each signal individually, but she can store these quantum 
states for later usage. In the classical post-processing 
phase, Alice and Bob exchange information about their 
shared bit strings over a authenticated classical channel. 
This information eventually leaks to Eve, who can make 
use of this additional knowledge to employ optimized 
measurement on her quantum states. Our starting point 
of the security estimation presented here is to assume 
that the quantum state effectively shared by Alice, Bob 
and Eve, is of product form yO®J^. In contrast to that, 
the most general coherent attacks can introduce correla- 
tions between the quantum states describing subsequent 
signals. However, it is known that this kind of attack 
does not give any advantage to Eve in the asymptotic key 
limit, if the local dimension of the involved Hilbert spaces 
are finite |ll| . Unfortunately, the quantum de Finetti 
theorem cannot be directly applied here, as one needs 
to bound the local dimension of Bob's received states, 
which generally is infinite dimensional in CV-QKD. Re- 
cent work [l^ indicates that there is hope that one can 
extend this results to the infinite dimensional case. 

The experimental feasibility of various CV-QKD 
schemes using coherent states as input and variations 
of homodyne detection has already been demonstrated 
7, "8^, 11 m [H, [H, [13 . Although promising from a tech- 
nological point of view as the measurement can operate 
at high repetition rates, the efficiency of these schemes 
seems to be limited by the classical post-processing pro- 
tocol. In general, the performance can be improved by 
using reverse reconciliation (RR): one reverses the flow 
of classical information in the error-correction step of the 



protocol, so that the raw key is based upon Bob's mea- 
surement results Q- If a practical error-correction pro- 
cedure with non-ideal efficiency is considered, additional 
procedures like postselection [18[ might become favorable 
to increase the efficiency [3|. Here, we limit ourselves to 
the idealized scenario of CV-QKD involving noiseless de- 
tectors and perfect error-correction. Consequently, we 
suppose that a RR protocol without postselection pro- 
cedures is used. The aim is to present the still missing 
security analysis for a discrete modulated CV-QKD valid 
in an idealized setting but considering arbitrary noise in 
the collective attack scenario. It should also be noted 
that in a typical physical realization, Alice sends an ad- 
ditional phase reference pulse to Bob via Eve's domain. 
In general. Eve could interact with this additional mode 
as well to gain more information about the exchanged sig- 
nals. As shown by Haseler et al. [19], a full security proof 
would have to take the full two mode structure of the 
signals into account, but also additional measurements 
have to be done to test the reference-signal structure of 
the two modes. Here, we present a simplified proof and 
assume that Bob's phase reference is prepared locally. 
Consequently, our signals are single modes. 

Typical experiments show that the dominant contribu- 
tion to the excess noise in CV-QKD is due to the elec- 
tronic noise of the detectors [la]- Therefore, we expect 
the channel excess noise relevant in CV-QKD to be rel- 
atively low and of the order of a few percent. Our anal- 
ysis is based on work done by Rigas [20|, who gave an 
estimation of the maximal eigenvalues and correspond- 
ing eigenstates of a quantum state based on homodyne 
detection. In our protocol, Alice uses coherent states as 
signals. If the quantum channel imposes loss onto the sig- 
nals, but is noiseless otherwise, Bob's received states p%, 
conditioned on Alice sending the bit- value x, are pure co- 
herent states. In contrast to that. Bob will receive mixed 
conditional states if the quantum channel imposes ad- 
ditional noise upon the signals. Consequently, the maxi- 
mal eigenvalue of the received states p^ will deviate from 
unity as 1 — ix- In this article, we use ix together with 
the overlap of the corresponding eigenstates ix as a fig- 
ure of merit to quantify the amount excess noise present 
in the quantum channel. These parameters will be con- 
nected to the observed measurement outcomes of Alice 
and Bob in Sec. V. For ix = 0, we retrieve the known 
results for the lossy channel given in Ref. [3]. Therefore, 
we expect our approach to yield positive key rates as long 
as the noise of the quantum channel and consequently ix 
is small enough. 

This article is organized as follows: In the next section, 
we introduce a binary CV-QKD protocol where Bob is 
allowed to coarse grain his continuous measurement out- 
comes to discrete bit-values arbitrarily, which will be used 
as the raw key. Therefore, we modify the known secu- 
rity analysis for collective attacks to include this addi- 
tional step in Sec. III. Then, we proceed by computing 
the secret key rate of a binary CV-QKD protocol with a 
fixed discretization of the continuous measurement out- 



comes. This will be done in two steps: in Sec. IV, we 
give an expression for the secret key rate in terms of max- 
imal eigenvalues and corresponding eigenstates of Bob's 
received conditional states. These parameters are then 
estimated via Bob's homodyne measurement in the pro- 
ceeding section. We conclude with a numerical evaluation 
of the secret key rate in a experimental relevant scenario 
and a discussion of the results. 



II. THE PROTOCOL 

We consider a prepare-and-measure protocol using 
continuous variable states and homodyne detection. In 
general, we allow Bob to discretize his continuous mea- 
surement outcomes and to do announcements arbitrarily. 
However, we also give a description of a concrete protocol 
as an example with those steps specified. This specific 
protocol will be used in Sec. VI to evaluate the secret 
key rate for a typical experiment numerically. Any QKD 
protocol can be decomposed into two phases. In the first 
phase Alice prepares quantum states and sends them to 
Bob, who then performs measurements on them. In the 
second phase, Alice and Bob use an authenticated two- 
way channel for classical communication to turn the clas- 
sical data (knowledge of signals sent, and measurement 
results) into a secret key. 

Quantum phase: 



1. Alice sends a sequence of coherent states with 
amplitude a but randomly selected opposing 
phase, |a) or | — a), to Bob. Alice stores her 
choice for signal z in a variable Xi by assigning 
to the choice \a) the value x; = 1, and to | — a) 
to Xi = 0. 

2. Bob randomly measures each signal with a ho- 
modyne measurement corresponding to the q 
or p quadratures [l3]. We denote Bob's mea- 
surement results as yi and denote the basis 
choice by the binary variable hi (We choose 
the reference frame such that the signal states 
are modulated in the q quadratures. 

Classical phase: 



3. After the quantum phase. Bob announces for 
each signal the measurement basis. 

4. Alice and Bob test their correlations by pub- 
lishing randomly selected data points Xi and 
yi. Moreover all of their data (Alice's modula- 
tion and Bob's full measurement result) that 
originated from Bob measuring the p quadra- 
ture is published and used to check for Eve's 
interference. 



5. Alice and Bob dismiss the data that originated 
from measuring in the p basis for the remain- 
ing key distillation part of the protocol in or- 
der to obtain the sifted key. 

6. Let us denote the string of outcomes pertain- 
ing to the sifted key as {x^y}. From the col- 
lection of outcomes y Bob computes a string u 
and y to that we will refer to as the announce- 
ment and the discretization in the following. 

7. Bob announces u and keeps y. In general, 
the announced vector u will have continuous 
entries. Bob could, for example, announce 
the modulus \yi\ of his measurement result, 
whenever he chose the g-quadrature as basis. 
The discretization y is vector with discrete en- 
tries from which the secret key will be gener- 
ated. This could be, for example, the sign of 
Bob's outcomes yt whenever he measured the 
^'-quadrature. 

8. Bob sends Alice error correction information 
to allow her to reconcile her string x of the 
sifted data to the corresponding string y. 

9. Alice and Bob do privacy amplification by ap- 
plying universal-2 hash functions to the string 
y, now shared by Alice and Bob. This will 
effectively shorten the string y by nr bits of 
information, where n is number of transmitted 
signals. 



This protocol is equivalent to an entanglement based 
protocol [2l|. In step 1, Alice prepares a entangled state 
l^t) = -^(|0)| —a) -I- |l)|a)) and sends the coherent state 
system to Bob. Then she measures her state in the |0) 
and |1) basis. Steps 2 to 9 remain the same. 



III. THE SECRET KEY RATE IN THE 
INFINITE KEY LIMIT 

Our security analysis follows the one given in Ref. 
[3, [i3|- Here, we limit ourselves to the asymptotic key 
limit as the number of entries n in the raw key y tend 
to infinity. Therefore, we only consider leading terms in 
n in the formulas. Let X, Y, Y and U denote random 
variables that can take the values x, y, y, u as introduced 
in the preceding section. In step 6 of our protocol. Bob 
announces u, so that this information becomes available 
to both Alice and Eve. The classical information con- 
tained in the announcement can be formally embedded 
in a quantum system pu- After the announcement, the 
system pxu describes Alice's data and pEU describes the 
state Eve holds. Later in the step 8 of the protocol Bob 
sends error correction information over the public chan- 
nel to Alice. As Eve can listen to this channel, the infor- 
mation W about the key contained in the error correction 
becomes available to her. Again, we can formally embed 
this classical information in a quantum state pw. After 



the error correction, Alice and Bob share y and Eve's 
knowledge about the exchanged data is summarized in a 
state pbuw- According to Ref. [22| one has to shrink 
the raw key by nr = ^CY : i?UW) bits of information 
in the asymptotic key limit, where S denotes the quan- 
tum mutual information [23|, so that the final key will 
be secure with high probability. The secret key rate that 
Alice and Bob finally can obtain is given by H{Y) — nr, 
where H(Y) describes the Shannon entropy of Y, which 
can be evaluated after the channel test. From Ref. Q 
we know that 

nr = S{Y : £:UW) < ^(Y : EIJ) + /(Y : W), (1) 

where / denotes the Shannon mutual information 24]. 
Alice has to correct all the errors in her string x in step 
8 of the protocol. Therefore, Bob sends Alice error cor- 
rection information. The amount of error correction in- 
formation necessary for Alice to succeed is given by 



/(Y : W) = /(e) [H(Y) - /(XU : Y)], 



(2) 



where /(e) > 1 denotes the efficiency of the error correc- 
tion procedure. Alice and Bob know the amount of pub- 
lished error correction information after step 8. In the 
following, we assume that the error correction is ideal, 
so that /(e) = 1. From the Eqs. (|ll2p we know that we 
have to shrink the key in the privacy amplification step 

by 

nr < S{Y : EV) + H{Y) - /(XU : Y), 

bits of information. The length of the final secret key 
that Alice and Bob can obtain is given by 



nG = H{Y) - nr 

> /(XU : Y) - S{EIJ : Y) 
= /(X : Y|U) - 5'(£; : Y|U) 



(3) 



In the third line we have used the result that S{UV : 
W) = SiU : W\V) + SiV : W), which also holds for the 
classical mutual information I{UV : W) in particular. 
The length of the secret key can be lower bounded as 

nG ^ /(X : Y|U) - 5(£; : Y|U) 

= /(X : Y|U) - 5(£;|U) + S'(£;|UY) 

> /(X : Y|U) - 5(Y : E) , (4) 

where we have used the definition of the quantum mu- 
tual information S{E : Y|U) in the second line. The 
third line follows from the concavity of the entropy [23| 
as we will explain now. After Alice's and Bob's mea- 
surements. Eve's knowledge about the exchanged data 
is summarized in conditional quantum states p^^ ■ Eve's 
states conditioned on Bob's measurement outcomes y are 
therefore given by 



V 

Pe 



! P{^\y)PE^ 



(5) 



From the measured outcomes y, Bob computes the an- 
nouncement u and the discretization y. This can be 
modeUed by a classical channel described by some given 
conditional probability distribution P {y\u) , y. The state 

p^^ can therefore be written as 



Pe ^ 



Y,p{y\u 



'. y) p"e 



(6) 



It follows that the conditional entropy S'(-E|UY) can be 
bounded from below as 

y 

= E / ^"^(^' y^^ (/ "^yP (yi"' y) pe 

y 
>J2 J duPiuJ) J dyP 



y\u,y) S{pI.) 



J2Piy)S{pl)^S{E\Y), 



where we first used Eq. ([6]) and then the concavity of 
the entropy. Since the conditional entropy S(E\\J) obeys 
S{E\\J) < S{E) by the concavity of the entropy [231, the 
last fine of Eq.© follows with the help of Eq. ^. 

The lower bound in Eq. Q has two terms, one depend- 
ing on the discretization Y, one independent of it. We 
expect to be able to find a discretization for arbitrary cor- 
relations between Alice and Bob, so that the first term 
goes to /(X : Y), e.g. a family of discretizations Ya 
that tend to the identity Ya — » Y asymptotically as 
A ^ 0. Here, the parameter A describes the size of the 
coarse-graining of continuous measurement outcomes to 
a certain discrete value. In Sec. VI we will give a simple 
example of a discretization that can achieve the bound 
/(X : Y) for particular class of correlations between Al- 
ice and Bob without an asymptotic procedure. 

In the following, we limit our security analysis to the 
collective attack scenario and assume that the total state 
shared by Alice, Bob and Eve has tensor product form 
Pabe- Thus, the measurement outcomes Xi and yi are 
independently identical distributed, and we can limit our- 
selves to single letter distributions. Then, Bob computes 
y and announces values u from his measured value of y. 
Therefore, Eq. (j4]) can be simplified as 



G>I{X:Y\U)-S{Y:E) 



(8) 



where we have introduced the single letter random vari- 
ables X, Y, Y and U that can take the values x, y, y and 
u respectively. The remaining central problem is to find 
a upper bound to S{E : Y) as the first term is already 
available from the observed outcomes. Without loss of 
the generality, we can assume Eve holds the purification 
of PABE- Define the set EABEip) as a collection of all 



of the possible pure state pabe that compatible with the 
observations available from the measurement. The secret 
key rate is then given by 

G>I{X:Y\U)- max S{Y : E). (9) 

Pabe£Sabe{p) 

In this article, we calculate this expression ([9]) for 
the binary modulated CV-QKD scheme introduced in 
Sec. II. This will be done as follows: first, we will di- 
vide the entropy S{Y : E) into three terms. Then we 
will give an upper bound to each term independently. 
These bounds can either be directly given by Bob's ob- 
served first and second moments or can be expressed as 
functions of the maximal eigenvalues and corresponding 
eigenstates of Eve's conditional states. We conclude our 
proof by estimating these parameters via the first and 
second moments of Bob's homodyne measurements us- 
ing the results of Ref. [20| combined with an argument 
based on Schmidt's decomposition. In the last section 
we evaluate the expected secret key rate G for typical 
observations numerically. 



IV. LOWER BOUND ON THE SECRET KEY 
RATE 

The central problem of calculating the secret key rate 
in a reverse reconciliation scheme according to Eq. [9] is to 
find an upper bound for the mutual information S{Y : E) 
that can be estimated by observable quantities. This 
will be done in the following. As the mutual information 
between Alice and Eve is given by 

S{X : E) = S{E) - S{E\X) , 

one can express the quantum mutual information S{Y : 
E) between Bob and Eve in Eq. Q as 



S{Y : E) = S{E\X) + S{X : E) - S{E\Y) 



(10) 



As already mentioned, we will proceed to calculate an 
upper bound for S{Y : E) by bounding the three terms 
S{E\X), S{X : E) and S{E\Y) on the right hand side 
of Eq. (fTO|) individually. As we will see later, we can di- 
rectly compute an upper bound for S{E\X) from Bob's 
observed data. The remaining two terms will be given as 
functions of the maximal eigenvalues 1 — e^ and corre- 
sponding eigenstates \ex) of Eve's conditional states p%. 
In Ref. 20] , Rigas presented an estimation of the max- 
imal eigenvalue and corresponding eigenstate of an un- 
known quantum state based on the first and second mo- 
ments of a homodyne measurement. We use this result to 
estimate the biggest eigenvalue 1 — e^ and corresponding 
eigenstate le^;) of Eve's conditional states p% via Bob's 
measurements. We can express Eve's conditional states 
using this notation as 



Pe = {^-£x)\£x){£x\ + 



SxCf 



E 1 



(11) 



where |e2:)(£2:| have cr|; orthogonal support. We will refer 
to the eigenstate belonging to the maximal eigenvalue as 
the maximal eigenstate. 

In the following, we will assume that the maximal 
eigenvalues 1 — Ex and eigenvectors je^) are given. Sec- 
tion V contains an estimation of these parameters from 
measurement data and will conclude our approach. 

It turns out that an upper bound for Eve's conditional 
entropy S{E\X), the first term on the right hand side 
of Eq. pO|) , can be obtained by exploiting Gaussian ex- 
tremality properties [25| . The second term is the mutual 
information between Alice and Eve S{X : E), which can 
be upper bounded by employing a suitable purification 
method. The estimation of the third term, the entropy 
S{E\Y) conditioned on Bob's measurement outcomes Y 
is technically more involved and includes a linearization 
of the respective quantities, so that a bound can be eval- 
uated. 



Eve's entropy S{E\X) conditioned on Alice's 
variable X 



For given first and second moments of Bob's measure- 
ment outcomes, we have to find an upper bound for Eve's 
conditional entropy S{E\X), which is the first term on 
the right hand side of Eq. (jlOp . The a priori probabilities 
P{x) are fixed by Alice's state preparation. In the entan- 
glement based description of the protocol, Alice's state 
preparation is equivalent to projection measurement onto 
her A system of a pure three party state pabe- It follows 
that the combined two party state p%g = \'^be){'^be\ 
between Eve and Bob conditioned on Alice's measure- 
ment outcome x is pure. Therefore, by Schmidt's de- 



composition, we conclude that S{p^) = S{p^) [23|. It 
is known that the state with maximal entrop y 5' ( /3r) for 
fixed first and second moments is Gaussian [25', '26] . Since 
S{p%) — S{p^) and P{x) is fixed, one can directl y ap ply 
the result given in Eqs. (15) and (16) of Ref. [26|, so 
that 

5(i?|X) = ^F(:r)5(pl;) (12) 

X 

^ I E[(i + ^-) i°g2(i + y^) ~ V, iog2 v^] . 



The term 



y-^xiyy, yy, -1/2 



(13) 



quantifies the amount of excess noise imposed by the 
quantum channel connecting Alice and Bob. It is a func- 
tion of Bob's observed variances Vy ix and Vy \x of the 
corresponding quadrature distributions, that are given 

by 

V^y,|x-tr(p^g2)-[tr(p^g)]^ (14) 



^y,|x-tr(p|,p2)-[tr(p^p)]^ , 



(15) 



and the quadrature operators q and p are defined as 

1 /. „tx 



(16) 



P=^^[a-a 



whereas a and a^ denote the photon annihilation and 
creation operators. 



B. The mutual information S{X : E) between Alice 
and Eve 



Here, we employ methods known from state estima- 
tion to calculate the mutual information term S{X : E) 
between Alice and Eve in Eq. pU|) . After interacting 
with the signal states. Eve holds the conditional states 
p^ in her ancilla system, that she wants to distinguish 
optimally in order to maximize the mutual information 
S{X : E). If we introduce an auxiliary system Q that 
contains a purification of the states p^ and p^, we can 
give an upper bound for S{X : E): the mutual informa- 
tion can never increase when discarding subsystems, so 
that 



S{X : E) < S{X : QE) 



(17) 



holds. We choose the purification Q, so that the con- 
ditional states p^ are purified as \'^eq)- There are cer- 
tainly purifications that would leak too much information 
to Eve, i.e. if one would supply Eve with a purification 
of the global state pxQE ■ Since Eq. (fT7| is valid for any 
purification, we would ideally choose one that minimizes 
S{X : QE) to make the bound p?]) as tight as possible. 
This problem is closely connected to Uhlmann's theorem, 
as we will show now. 

It has been shown that the quantum mutual informa- 
tion between a classical register described by the binary 
variable X and a quantum system QE can be expressed 



S{X : QE) = h 



^(l-K^gl^i^Q) 



(18) 



if the conditional states I^^eq) ^^^^ pnve Q. Here, h de- 
notes the binary entropy function 



h{z) ^-z\0g2Z- (l-z)log2(l-2:) 



(19) 



Since S{X : EQ) monotonously increases with decreas- 
ing overlap K^^jqI^^q)!, it is sufficient to find the pu- 
rification Q that maximizes the overlap K^^jq |^bq)| to 
minimize S{X : EQ). The solution to this problem is 
known as Uhlmann's theorem I23II: 



F (p%,Pe) = rnax 



\{^eq\^eq)\ (20) 



Here, the Uhlmann fidelity F {p%,p\^) is defined as 

F{p%,p\:)=tr^U^p],^\ . (21) 

Therefore, we conclude that the tightest bound obtain- 
able from Eq. p?|) to mutual information S{X : QE) for 
a binary modulated setup is given by Eq. (j20p and Eq. 
dUl) as 



S{X :E)<h 



\i^ 



Fip'E.p'E)} 



(22) 



In general, the upper bound ()22p of the mutual infor- 
mation S{X : E) can be calculated, if the Eve's condi- 
tional states p% are known. However, the full information 
about the states p^ is usually not available from mea- 
surements. As already mentioned, we base our security 
analysis on the estimation of the maximal eigenvalues 
1 — ix and corresponding eigenstates \ex) of Eve's condi- 
tional states pI; that we will estimate by Alice and Bob's 
observation. Therefore, we proceed by giving an upper 
bound of S{X : E) as function of these parameters. This 
can be done by by considering a particular purification 



Any purification |^|;q) can be expanded as 



(23) 



Without loss of generality, we can choose the first term 
in the Schmidt-decomposition ((23| to correspond to the 



maximal eigenvalue Cg := 1 — Ex- The corresponding 
eigenstate is then given by Eq. pT|) as |0|;) = le^;). With 
the help of expansion (P5|). the modulus of the overlap 
between the two conditional states can be evaluated as 



|(*BQl*iQ>| 



E^°4(*°b-Q)(^°^b-^) 



(24) 



If one chooses {i%\JQ) = SijC^'^', where Sij is the Kro- 
necker delta function and the phase ipi is the negative of 
the phase of the complex number {i%\i\;), it follows that 



H^^eqI^eq) 



E^?^^ 



■ '(*bI*b/ 



(25) 



> V(l-^~o)(l-ei)|(eo|ei)| 



Therefore, we obtain a lower bound on the quantum 
mutual information S{X : E) using Eq. P^ and Eq. 
dig) as 



S{X : E) < S{X : QE) 
1 



(26) 



<h 
where we introduced 



(1 - V(l-£o)(l-ei)7) 



as a short hand notation for the overlap of Eve's maximal 
eigenstates. In Sec. V we will estimate the values for ix 
and 7 via Bob's homodyne measurements. 



Eve's entropy S{E\Y) conditioned on Bob's 
measurement outcome Y 



The last term of Eq. PH)) to be estimated reads 



S{E\Y) = / dyP{y)S{pl 



(28) 



Prior to Alice's measurement, the three party state pabe 
can be assumed to be pure. Since Alice performs a pro- 
jection measurement on her subsystem, it follows that the 
combined two party state p^g = \ '^g^) {^be I between 
Eve and Bob conditioned on Alice's measurement result 
is pure. Moreover, Bob performs a projection measure- 
ment \y){y\ on his subsystem, so that Eve's state |^^^) 
conditioned on Alice's measurement outcome x and Bob's 
outcome y is pure. Eve's states p|; conditioned on Bob's 
measurement outcome y can be written as 



pl^P{0\y)\V^ 


y){^%y\ + Pii\y)\^]y){^'ly\. (29) 


From Sec. III.C of Ref. [3] we know that 


S{pl) = h 


i - i^l - 4PiO\y)P{l\y){l - K*^^!*^'')^) 


- 9 {P{0\y), 


{^'I\^e') 


) , (30) 



where 



{p{o\y), 



have 



Oy\,TAy\ 



*^^|* 



E , 



introduced the function 
as a shorthand notation. 

As we can see, the entropy S{E\Y) to be evaluated is a 
function of the overlaps 



r, = i^'il^'i) 



(31) 



that depend on the outcomes y. Additionally, the proba- 
bility distributions P{0\y) and P{y) need to be estimated 
by the channel test. We will proceed to lower bound the 
entropy S{E\Y) (^5]) by exploiting special properties of 
the g function given by equation pop . It can be easily 
verified that g {P{Q\y), Ty) as a function of the overlaps 
has the following properties: 



5(^(01?;), 1) 

dgiP{0\y),x) 

dx 

d^g{P{0\y),x) 

dx^ 



= 
<0 

<0 



(32) 
(33) 

(34) 



We introduce positive and real parameters jy and A'jy 
such that we can rewrite the overlap Ty pi|) as 



7:= K£o|ei)| , 



(27) 



Ty<Jy + A-fy 



(35) 



s(^(o|i/),r„: 



5(F(0|:</),7, + A7„)) 




5(no|:y),7.)-™^A7, 



FIG. 1: Schematical representation of the function 
g(P(0|l),r„).The validity of Eq. (|36j can easily be checked 
for all Ty < yy + A^y. 



It follows that for any < Fy < 1 the inequality 



5(^(0|y),r,)>.g(P(0|y),7, + A7,) 



(36) 



l"7a 



holds, as the first line of Eq. ([5S|) follows from the niono- 
tonicity ([33)1 and the second line follows from the con- 
cavity ([M)) together with property ([5^ if < 7^ < 1. 
Later we will give explicit expressions for the decomposi- 
tion ((35)l . so that these properties can easily be checked. 
Fig. IH) illustrates Eq. ([M|) schematically. 

Moreover, the approximation of Eq. p6p can simplified 
further, if one could find a parameter 7 independent of y 
with the properties 7 > 7y and 7 < 1, as 



g{P{0\y),jy)>g{PiQ\y),j) 
9{P{0\y),ly) ^ ff(P(0|2/),7) 

1 - 7y - 1-7 



(37) 



We will see later that setting 7 to 7 as defined in Eq. 
(P7)) satisfies these constraints. The first bound of ([57]) is 
a simple consequence of the monotonicity (|33p . whereas 
the second inequality follows from the properties (P^HM)) . 
It can easily be verified by realizing that the quantity 
g(. j-Jjj,-'' "> is given by the modulus of the gradient of 

the straight line connecting the points g {P{0\y), Ty) and 
g{P{0\y),ry = 1) = 0. From Fig. [1] it is obvious that 
this modulus increases if one chooses the point Fj, to be 
closer to one. Therefore, the second bound of (|37p is valid 
for all 7 satisfying 7j, < 7 < 1. Finally, we can estimate 
the conditional entropy S{E\Y) given by Eq. (P5)l with 



the help of the expressions (|36|) and ([37)1 as 
S{E\Y) ^ j dyP{y)S{pl) 

> j dyP{y)g{P{Q\y),^) 

- j^ J dyP{y)g{P{0\y),j)Ajy . 
dyP{y)g{P{0\y),^)-AS, 



(38) 



where we introduced the term AS' as a shorthand nota- 
tion. 

In the following, we will give explicit expressions for 
the missing parameters 7j,, A7j^ and 7 in order to con- 
nect these parameters to quantities that are observable 
to Alice and Bob. The starting point of this analysis is 
again noticing that the state 1'^%^) that Bob and Eve 
share conditioned on Alice's measurement outcome x is 
pure, so that one can decompose it as 



\nE) 



v/(l-£.)l/3a;)|e. 



SxlfEB) 



(39) 



using Schmidt's decomposition theorem [23j|. We have in- 
troduced eigenstate \f3x) of Bob's conditional density ma- 
trix pg corresponding to the maximal eigenvalue 1 — £a;. 
All terms orthogonal to \Px)\£x) are summed up in the 

term \(Peb)^ such that {PxI^eb) = and (ixlfEB) = 0- 
From Eq. ([55]) . one can construct Eve's states |^^^) 
conditioned on both Alice's and Bob's measurement out- 
comes as 



xy. _ Vi'^-£x){y\l3x)\ex) 



\n') = 



£x{yB\(p%B) 



VPivl^ 



(40) 



by projecting Bob's system onto |2/)_b(j/|. The conditional 
probabilities P{y\x) are given by 



Piy\x) = il-ex)\{y\px)\^ 
By setting 



£x\{v^%B\y)B{y\^EB)\ 



and 






\/{VEB\y)B{y\fEB) 



we can express Eq. (|40|) as 



l*^'') 



V^ 



)a.y\ex 



Sxb^yl^E' 



(41) 



(42) 



(43) 



(44) 



where \sx) is orthogonal to \(p^). The normalized states 
lip^i^) are given by Eqs. (gOl), ((4^ . (liS)) and (|44| as 



\fE') 



i{'PEB\y)B{y\^EB)) MJ/sI'/'Is) 



(45) 



Without loss of generality, we can choose a^ and by to be 
real. Moreover, from expansion (|^^ it is obvious that 



Vl - e^a^ < 1 



holds. The overlap Ty is given by Eq. (|44)) as 



;*°/i*^') 



(46) 



(47) 



v/(l -£o)(l ~£i)ayal (eo |ei) 



so that Eq. ([55)1 follows from ([17|) by triangle inequality 
with the parameters ^y and A7J, defined as 



7y 



A7y = 



V(l-eo)(l-ei)a;;4(£o|ei> 
V(l-eo)(l-£i)a"4 



(48) 



V{l-e,)s,aX{eo\^'y) 



v/(l-ei)eo&X(^^'|£i> 



+v/i;;i^&"6^(//i^s') 



With the help of Eq. (|iS|) , the parameter 7^ can be upper 
bounded as 



"fy 



v/(l-£o)(l-ei)aX 



7< 7 



(49) 



so that we can set 



7 = 7 



(50) 



to satisfy jy < 7. Moreover, it can easily be checked that 
< 7y < 7 < 1 using property (|46ll . 

In principle, we have now everything at hand to lower 
bound the conditional entropy S{E\Y) according to Eq. 
([38|) . However, as we will see later, we can only estimate 
the overlap 7 = |(eo|ei)| and eigenvalues 1 — Sx from 
Bob's measurements. As a consequence, the parameter 
A7J, cannot be estimated by the observation and con- 
sequently the term A5' in Eq. (j38p cannot computed 
directly. Since AS' is monotone in the parameter A7J,, 
it is again possible to lower bound the entropy S{E\Y) 
by looking for a suitable upper bound for A7J, which is 
a function of Bob's observable parameters. Here, we es- 
timate the parameter A7J, starting from the definitions 



aSl) as 



V(l - eo)eia°&y {^o\^]!) 



(51) 



V(l - ei)£Qalbl (eilvs/) 



<v/(l-£o)£~ia°&Jv^l-|(£o|ei)r 



+ V(l-ei)£oa>°\/l-|(£o|ei)|' 
+ \/eQ£iblbl 



where we first used the triangle inequality. For the second 



inequality in Eq. (|5ip we used 



Pi/|,^ii/\ 



{VeWiI 



< 1 and 



mex)\' + m^iy)r<i, 



(52) 



which is valid for any vector |$) by orthogonality of the 
states lix) and l^fi^)- In particular, we used 



(£0 El) 



(£1 eo) 



[^oI^e) 



iei\ip°i) 



< 1 



< 1 



(53) 



which follows from Eq. ([52|) by setting |$) = |eo) and 
X = 1 for the first inequality or respectively |$) = |£i) 
and X = for the last inequality in Eq. ([55)) . In the last 
step of Eq. ([STjl . we used the definition (p7)) of 7 and the 
bound (j451) . 

With the expression (j5ip . we can upper bound the term 
ASof Eq.® as 



AS < 



,Ji±l J dyPiy)giP{0\y),j) (^^ob^ + V^ibl) 

(54) 

+ Y^ J dyP{y)g{P{Q\y),j) (yi;;?^^^^^) . 



These integrals can be estimated first applying the com- 
pleteness relation J dy\y) {y\ = / of Bob's homodyne mea- 
surement to the definition (|43p . It follows that 



dyP{y\x)bf = / dy{^ls\v)B{vWlB) = 1 • (55) 



This condition on the parameters by enables us to upper 
bound the remaining terms in Eq. (I54p as 



dyP{y)g{P{Q\y),^)^eM 



< 'il^'^-^'-^W^- 



(56) 



and 



dyP{y)g{P{Q\y).l)V^iblbl < ^/iofig -,7 



(57) 

with the help of the Cauchy-Schwarz-Buniakovsky in- 
equality [23|- Details of this estimation can be found 
in Appendix [Al 

Let us summarize our results. We can use Eq. (1501) in 
Eq. ((38|) to bound the conditional entropy S{E\Y) as 



SiE\Y) > J dyP{y)g {P{0\y), 7) - A5 



(58) 



It follows from the inequalities ([M|) . ([5S|) and ([57]) that 
the term A5 can be upper bounded as 



AS* < £0^0 + £1^1 + \/eoS[k 
where we defined parameters kx and k as 



k 



' 1 + 7 
2(1-7) 



51 o'7 



dyP{y) 



P{x\y) 



(59) 



(60) 
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Finally, a lower bound for the conditional entropy 
S{E\Y) is therefore given by Eqs. (l58|) and ([M]) as 



(61) 



S{E\Y)> I dyP{y)g{PiO\y),j) 



D. The mutual information S{Y : E) between Bob 
and Eve 

We have shown that an upper bound for the mutual 
information S{Y : E) between Bob and Eve is given by 
Eq. (UnD, inD, (EID and ^ as 

S{Y : E) ^S{E\X) + S{X : E) - S{E\Y) (62) 

<\ E[(i + ^-) i°g2(i + y^) - y-^ iog2 y.] 



(1 - V(l-eo)(l-ei)7) 



dyP(2/)5[P(0|2/),7] 
^0^0 + V^ifci + \/eo£ik 



4 Etd + y-) iog2(i + ^=^) - y- iog2 ^.] 



+ s(4,7) 



(63) 



The first term in Eq. (I62p can be directly computed from 
Bob's observed variances (|14p using Eq. P^ . Here, we 
define the function s(£x,7) to summarize all terms that 



depend on the maximal eigenvalues 1— £3; and overlap 7 of 
the corresponding eigenstates of Eve's conditional states. 
The remaining problem is to estimate these parameters 
via Bob's homodyne measurement. 



V. MAXIMAL EIGENVALUE AND 
EIGENSTATE 

We have already shown in the last section that the two 
party states I^^b) conditioned on Alice's measurement 
outcome x can be chosen to be pure. Therefore, one 
can expand these conditional states using the Schmidt- 
decomposition p9|) . so that the state \Px)\£x) is orthog- 
onal to \'P%b)- Fi'om Eq. ((39|) it follows that the p% and 
p|j have the same spectrum. Moreover, the eigenvectors 
of Bob's and Eve's system are determined up to a global 
unitary operation on Eve's system. According to Eq. 
([S^ . we need to estimate the modulus of the overlap of 
Eve's maximal eigenstates \ex) and the maximal eigen- 
values 1 — £a; . These parameters can be estimated from 
the first and second moments of Bob's measured data 
[2(j |. as we will see in the following. 

Suppose the fidelity between Bob's received condi- 
tional state p% and a pure coherent state |/3) satisfies 



{Px\pl\Px) 



1 



(64) 



The amplitude /3^ is given by the first moments of Bob's 
homodyne measurement as 



Re(/3J 
iM'Px) 



tr{plp) . 



(65) 



The quadrature operators q and p are defined in Eq. (|16p. 
In the following, we will refer to the parameter £x as the 
mixedness of Bob's conditional states. 

It has been shown by Rigas |20l| that the mixedness £x 
of the conditional states can be upper bounded from the 
outcomes of a homodyne measurement as 



£x < 



1 



(V, 



Y,\x + 2'\yYj,\x 



1 



Ux. (66) 



where Vy \x and Vy i^. denote the variances of the q- 
and p-quadrature distributions (fT4|) conditioned on Al- 
ice's variable x. The proof for the estimation ([M)) is 
given in Appendix (|B]). Moreover, one can also estimate 
the overlap |(/?o|/?i)| of Bob's maximal conditional eigen- 
states as 



ci{ex,£x,K) < |(/3o|/3i)| < Cu{£x,£x,k) 



(67) 



if one assumes that the fidelity (l64|) is given. Here, the 
parameter k is given by the overlap of the coherent states 
corresponding to the mean values ([S5)) as 



\iPo\Pi) 



(68) 
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The detailed expression of ci{ex,Sx, k) and Cu{£x,£x, k) 
can be seen in Appendix [U] 

The resuhs (|66p and ([67|) can be used to estimate the 
maximal eigenvalues and overlap 7 of the corresponding 
eigenstates of Eve's reduced density matrix. From the 
Schmidt decomposition (f39|) it follows that the eigenval- 
ues of Bob's and Eve's reduced conditional density ma- 
trices are identical, so that 



<ex 



(69) 



can easily be seen by expanding pg in its eigenbasis. 
Moreover, Eve's attack should preserve the inner prod- 
uct [i|, so that (-a|a) = {'^beI^be)- I^ Appendix [D] 
we show that this allows us to bound the overlap 7 of 
Eve's eigenstates as 



di <'-f < du 



(70) 



where 
and 



-a\a)\ - y [^(l-ei)£o + ^(1 - £'o)ei]^ + eieo 



^(1 - £o)(l -ei)c„ {ex.,ex,K) 



(71) 



du = 



|(-a|Q;)| + y[^(l-£i)eo + \/(l-£o)£i]^ + eiCo 
^(1 -£o)(l-£'i)ci {ex.Sx.n) 



tremal values of the overlap 
eigenstates as defined in Eq. 



(72) 
The functions ci{sx,£x, 1^) and Cu{sx,£x, 1^) are the ex- 

(/3o|/3i) of Bob's maximal 

dSZl). 

If the first and second moments of Bob's measurement 
outcomes are fixed, Ux is given by Eq. (|66|) . Therefore, 
the parameters ix that are compatible with the observed 
data can vary between < ix < £x ^ Ux- In that 
respect, the quantities Sx and ix are interior parameters 
that can only be bounded by the value of the observable 
quantity Ux- For any given value of Ex, ix and k, the 
interval of compatible overlaps |(/3o |/3i) I according to Eq. 
(I67p can be given. This in turn determines the interval 
of possible overlaps 7 via Eq. ([70]) . The value for k is 
obtainable from the first moments of Bob's homodyne 
measurement, as can be seen from Eq. (j65p . Finally, the 
secret key rate can be obtained by 



G>I{X -.YlU) 



max 
< ix < £t < Ux 



Mex,i) (73) 



di <^ < d^ 

- \ E[(l + ^-) l0g2(l + K) - Vx l0g2 VxW 



2Z.L 

X 

The maximum is taken over the interior parameters ix^ 
£x and 7 satisfying the bounds shown. These interior pa- 
rameters can vary in intervals that are fixed by the values 
of Ux and k that can be determined from the observa- 
tion. As the s-function ([S^ contains details about Bob's 



measured data via the probability distributions P{y) and 
P(0|y), this additional information must be estimated 
from the measured data to analyze the secret key rate 
numerically for a given observation. 



VI. NUMERICAL RESULTS 

The secret key rate ([75|) depends on Bob's observed 
probability distributions P{y\x) directly via the mutual 
information term I{X : Y\U) between Alice and Bob and 
via the term s{ix,"f)j as can be seen from Eq. (p^ . The 
distribution P{y\x) is in principle available from exper- 
iments. To evaluate the secret key rate in an example, 
we simulate data for a typical experimental situation in 
which we find a Gaussian distribution [3, [3, [lal • There- 
fore, we choose the probability distribution P{y\x) to be 
parameterized as 



P{y\x) 



2-^y,|. 



: CXp 



Y,\x 



(74) 



Here, rj is the observed channel transmission, the ampli- 
tude ao = —ai is chosen to be real. In this parameteri- 
zation, the value of k as defined in Eq. (|68p is given by 
by the loss of the quantum channel and the overlap of 
Alice's input states as 

«-|(V^a|-V^a)l • (75) 

Furthermore, we assume that Bob observes the same vari- 
ance ((T4)) in his measured data for both the q- and the 
p- quadratures, so that 



V, 



Y,\x 



= v. 



Y^\x ■ 



(76) 



Here, we use the convention for the excess noise 6 given 
in Ref. i28,l: 



y2 



1/2 

^y, I a;, Vac 



(77) 



The quantity V^^^^y^^ 



i is the quadrature variance of 

the vacuum state. As the a priori probabilities p{x) = ^ 
are fixed, the probability distribution p(y) is can easily 
be evaluated with the help of (|74p and the secret key rate 
can be evaluated according to (|73p . Fig. ^ shows our 
numerical results for the secret key rate versus the loss 
1 — rj and different values for the excess noise 5 in this 
typical scenario. 

For the simulation, we assume that Bob announces the 
modulus of his measurement outcomes y 3S, u = \y\. The 
values of y are determined by the map y = Q ii y < 
and y = 1 otherwise. After the announcement, the 
conditional mutual information between Alice and Bob 



I{X : Y\U) 



H{X\U) + H{X\YU) 
H{X)-H{X\Y) 
I{X : Y) . 



(78) 
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VII. CONCLUSION 




FIG. 2: Secret key rate versus channel loss for a 

typical scenario with optimized signal strength. The 

different lines correspond to an excess noise 5 of 
{0, 0.0004, 0.0008, 0.0012, 0.0016, 0.0020, 0.0024}. 



The announcement u ~ \y\ contains no information 
about the bit-value x for symmetric probabiUty distri- 
butions Uke ([7^ as the conditional probability p(u|a;) for 
a particular announcement u is independent of x. There- 
fore it follows that H{X\U) = H{X). The knowledge 
of Bob's measured outcome y is obviously equivalent to 
the knowledge of u = \y\ and the sign of y, so that we 
have H{X\YU) = H{X\Y). Therefore, we can achieve 
I{X : Y\U) — I{X : Y) with this simple map as long as 
the probability distribution satisfies the symmetry con- 
dition p{x\u) = 1/2. 

For the numerical evaluation we optimize the secret 
key rate G over the overlap {—a\a) of the input states. 
In the optimization we vary a between zero and 1 with 
step-width 0.05. For each a we find the maximum of 
s(ex, 7) over all e^ < Sx < Ux and di < j < d„. We find 
numerically that the maximum of s{ex, 7) is attained at 
the point j = di. 

Fig. (21) shows the results of our simulation. As we 
can see, the secret key rate is very susceptible to noise, 
whereas it coincides with the optimal bound given in Ref. 
[31 for lossy but noiseless quantum channels. However, 
one should keep in mind that we only calculated an upper 
bound for Eve's knowledge, which we expect not to be 
tight for finite excess noise. We have bounded all three 
terms in Eq. (jlOp separately rather than bounding those 
terms simultaneously. Furthermore, one might expect to 
find a different purification for the system Q to make 
the bound (|26p tighter. Finally, we have linearized the 
conditional entropy S{E\Y) in Section III. B in order to 
be able to find a bound. However, the error introduced 
here might be quite large. 



We have evaluated a lower bound to the secret key rate 
for a binary modulated CV-QKD protocol in the collec- 
tive attack scenario. The analysis can be applied to any 
given channel noise, as Alice and Bob can estimate the 
conditional probability distribution p{y\x) of their mea- 
surement outcomes arbitrary well in the limit that the 
number of exchanged signals tends to infinity. For any 
given probability distribution, the secret key rate can be 
computed according to Eq. ([75)1 . Although we demon- 
strate that our approach yields positive secret key rates 
for the case of small Gaussian excess noise, these results 
are not satisfying from a practical point of view, as the 
secret key rates drop quickly with increasing excess noise. 
Typically, the dominant contribution to the excess noise 
in CV-QKD experiments originate from noisy detectors. 
Our numerical results therefore indicate that it is neces- 
sary to analyze these kind of schemes in a trusted device 
scenario, if one wants to drop the assumption of ideal 
detectors and obtain secret rates of practical relevance. 
In this scenario, Eve cannot exploit the noise added by 
the detectors. 



There are several options to make the protocol more 
robust against channel excess noise. One could use more 
input states in order to test the quantum channel be- 
tween Alice and Bob more efficiently and consequently 
limit Eve's possible interaction with the signal states. If 
one compares the secret key rates of Fig. ([2]) with those 
given in Ref. [4'| which correspond to a protocol using a 
Gaussian modulated, continuous set of input states and a 
quantum channel imposing Gaussian noise onto the sig- 
nal states, one realizes that the robustness of the secret 
key rate increases by orders of magnitude. An introduc- 
tion of a postselection step in the protocol can help to 
increase the performance as well. 
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APPENDIX A: 

CAUCHY-SCHWARZ-BUNIAKOWSKY 

INEQUALITY 



APPENDIX B: ESTIMATION OF THE 

MIXEDNESS e^ VIA HOMODYNE 

MEASUREMENTS 



The Cauchy-Schwarz-Buniakowsky inequality states 
[27| that for any two integrable functions f{x) and g{x) 

U'dyfivMy)] < (J'dyfiy)] Ij'dyh^y)] 

(Al) 
holds. Application of inequality (jAip to the left hand 
side of expression ([56|) yields 



dyPiy)g[P{0\y),jWe,b-y 




dyy^P^x)bl{P{y)g[P{0\y),j]/y^P{^} 



f{y) 



Hv) 



< VT^J dyP{y)g^[P{0\y),^] 



Pjy) 

Piy\x)- 



(A2) 



Since one can rewrite the conditional probability P{y\x) 
as P{y\x) — P{x\y)P{y)/P{x) by using Bayes' rule and 
the a priori probabilities are given by P{x) = ^, we have 



P{v) 



(A3) 



P{y\x) 2P{x\y) 

and inequality ^Q follows from Eq. ((X2|l and Eq. (TO)) . 
Similarly, one can evaluate the left hand side of Eq. 
(l57t with the condition (l55l) as 



dyP{y)g [P{0\yh] V^iKK 



(A4) 



< 




dy^/pW)bl{P{y)9[P{m. i]IVpW)} 



fiv) 



Hv) 



dyP{yWy 



o23HP(%)i7l 
P{Q\y)P[l\y) 



where we used Eq. (|A3P again in the last step. Further- 
more one can show that 



dyPiymf'^'^'^'^^'^ 



P{Q\y)P{l\y) 



-" U(0|y)P(l|y) 



(A5) 



45' 



1 

2'^ 



The first line of Eq. (jASp again follows from the bound- 
ary condition (j55|) for any integrable and bounded func- 

p{o\v)P{i\v) ■ ^^^ second step can be shown by an 



tion 



involved but straight forward calculation. Eq. (j57|) now 
follows from Eqs. (|X4l) and ([Mjl . 



In this Appendix, we prove that the parameter Ex as 
defined in Eq. ([M|) can be estimated via Bob's homodyne 
measurements as 



1 
ex<- 



y. 



yq\^ 



y. 



Vpl^ 



\^-^ 



= \iw-i) 



(Bl) 



The mixedness £x is given by the fidelity between Bob's 
received state p|; and the pure coherent state [3x as 



{P.\pb\P.) = 1 



(B2) 



The amplitude /3^ is given by Eq. (j65p and we use the 
convention (J16p for quadrature operators. The condi- 
tional variances V^ , and V^ , are then given by 



Vp\x 



yq\x 



tr [pbp') 



[tr{plp)f 



(B3) 



Let us introduce a state p = D{—f3^)p^D{(3^) with 
zero mean values for the quadrature operators ([TB)) to 
simplify the analysis. Here D{(3x) denotes the displace- 
ment operator according to the amplitude (3^ . Obviously, 



ip||/3> = (0|p|0) = 1 - e. 



(B4) 



holds, whereas |0) denotes the vacuum state. The vari 
ances (IB3I) can now be evaluated with the definition ([16] 



as 



Vl\x = tr {-pe) = ^tr [p (2n + 1 + a^ + ^t^)] (B5) 
tr (pp2) ^ itr \p (2n + 1 - a2 _ at2)] ^ 



ypl^; 



where we have introduced the photon number operator 
h = <v a as short hand notation. The quantity W in Eq. 
(IBll) now reads 



ly =itr 
4 

X tr 



p[2n + 2 + d? + {a^f^ 



(B6) 



= [tr(pn) + lf-itr[p(a2 + at2)]' . 

We proceed in rewriting the last term in (|B6p with the 
help of Eqs. (jBSp in the Fock-basis {!«)}« as 



tr \p (a^ -I- a^2^] = ^ V^rr2V^rTT(n + 2|/5|n) (B7) 

00 

+ X! VnVri~l{n - 2\p\n) 

00 

=2 ^ Vn + 2Vn + lRe(n + 2\p\n) . 

n=0 
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Since (J|p|j) is a positive semidefinite matrix, any prin- 
cipal minor is a positive semidefinite matrix. It follows 
that 



{^\m{J\-p\J)-\{A-p\J)?>^■ 



(B8) 



as this can be interpreted as the determinant of the 2 
by 2 principal minor that arises by only keeping the i-th 
and j'-th entries. The positivity of this determinant then 
follows by realizing that the determinant is just the prod- 
uct of the non- negative eigenvalues of the corresponding 
principal minor 29]. The result (|B8|) . together with the 
triangle inequality, can be used to estimate the modulus 
of Eq. jlZl as 



|tr \p (a^ + a)'^)] \ <2 ^ ^f^{T2^f^{Tl\/ {n\-p\n) (B9) 

n=0 

X ^ {n + 2\-p\n + 2) 



<2, 



. Y.^n+\){n\-p\n) 

\ n=0 



i 



^(n + 2)(n + 2|p|n + 2) 

n=0 



=2\/tr(pn) + iVtr(pn) - (l|p|l) • 

(BIO) 



The second estimation in Eq. (|B9P follows from the 
Cauchy-Schwarz inequality. Inserting this result into Eq. 
(|B6|) yields 



W> [tr(pn) + l][l + (l|p|l) 



(Bll) 



tr {ph) 


oo 

^(l|p|l) + >;(n 

n 2 


\p\n)n 




>(l|p|l>+2(e,- 


-(1|P|1)) 



We need to find a lower bound on Eq. (|B11[) depending 
only on Ex- Note that tr (pri) can be written as 



(B12) 



As it can be seen from Eq. (jB4|) , the fidelity of p with 
the vacuum is 1 — e^, . It follows that all matrix elements 
(n|p|n) for n > 1 sum up to e^, so that 'Y^^=2^''A'pW)^ is 
minimal if all (n|p|n) = except for (2|p|2), which has 
then to be equal to £x— (l|p|l) by the summing condition. 
Therefore, Eq. (|B11[) can be estimated as 



W>{1 

= 14 



h2e, 

2e^4 



(l|p|l))(H-(l|p|l)) 
(l|p|l)(2e.-(l|p|l)) 



(B13) 



As < (l|p|l) < £a;, the last term of Eq. (|B13|) is never 
negative and equal to zero iff (l|p|l) = 0. It follows that 

W>l + 2ex ■ (B14) 

Inserting this result into Eq. (jBip concludes the proof. 



APPENDIX C: ESTIMATION TO THE OVERLAP 
OF BOB'S MAXIMAL EIGENSTATES 

In the following, we derive explicit expressions for the 
bounds to the overlap |(/?o|/3i) of Bob's conditional eigen- 
states to the maximal eigenvalue 1 — e^: as given by ex- 
pression ([67|) . Assume that we know the fidelity 



{(ix\PB\P.) = 1 



(CI) 



of Bob's received state p|; with the coherent state \(3x) 
is given. The amphtude (3x is defined in Eq. ([^ . We 
can express the conditional states p^ in a natural basis 
of displaced Fock-states {|(?!'^)} — {D[l3x)\k)}. Here, the 
the parameter k labels the photon number. Obviously, 
\Px) — l<^o) holds. In this basis, p^ reads 



Pb 



aoo ooi 

^01 '^11 



= V'-'D'-'V 



x^ 



(C2) 



where V^ denotes a unknown unitary matrix and _D^ is 
the representation of p|j in its eigenbasis. Without loss 
of generality, we can choose the first element in the D- 
Matrix to correspond to the biggest eigenvalue, so that 



i?m = 1 - ex 



(C3) 



From Eq. (|C2p . we know that 

oo 

1 - e. = aoo = K,?Dl, + Y. Kk\^Dl, (C4) 

As V^ is unitary, it follows that 

oo 



fc=l 



"^00 I 



(C5) 



fe=i 



Moreover, D^ is normalized, so that 



Y^Dl^^l-D, 



af) — ^x , 



(C6) 



fe=i 



where we used Eq. (|C3p . This can be used to bound the 
infinite sum in Eq. (|C4[) as 



Y.\^nl\'Dl,<(l-K,\')ex. (C7) 

fc=i 

since all terms \Vq^\^ and D%f. appearing in the sum are 
strictly positive. Therefore, we can bound Eq. ()C4|) ac- 
cording to inequality (jC7p as 



l-ex< iKTol' (1 - e.) + (l - 1^00 1') ^^ 
^\V^^\\l-2ex)+~ex. 
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It follows that 






(C8) 



Moreover, one can use Eq. (|C4p to obtain a lower bound 
on l^o^ol^ as 



i-£x>iVor(i-e.), 



so that 



Vor < 



l-£x 
1 -e^ 



(C9) 



(CIO) 



On the other hand, Bob's conditional states can be writ- 
ten as 






(cii) 



Pb 



where the unitary operation U is given, up to an unim- 
portant unimodular phase, by C/ = -D {p^l ^ {~Po) ^^'^ 
D denotes the displacement operator. Let us denote the 
eigenvectors of Bob's conditional states p^ as {|/3f )} with 
IPx) being the eigenstate corresponding to the biggest 
eigenvalue 1 — e^- With the representation (jClip , these 
states can be written as 



so that 






k,j=0 



(C12) 



(C13) 



By use of the triangle inequalities, one can construct an 
upper bound as 



iPolPi) <\Uoo\K\\Vo'o\ + K 



00 



E ^"'^0 



IVool 



Eu^oV^o' 



fc=i 



1=1 

oo 



(C14) 



E Vko*UkiV,l 



k,l=l 



and a lower bound as 



Upper bounds on the sums in Eas. (jC14p and (jC15[) can 
be obtained by using the Cauchy-Schwarz inequality as 



E \Uko\ K\ < Vl - \Uoo\yi - \V,%f (C16) 



fc=i 



Y.\Uol\\Vll\<^Jl-\Uoo\yl-Ko\ 

cso 



k,l=l 



<\n- 



l~\V}J^ 



It is easy to see that |C/oo| = l(/3ol/9i)l '■— i^- Finally, 
inserting Eqs. ([CHl [ClOl [UIBll in Eq. (|UT4)) yields 



mpi) 



<K 



1 — EO / 1 — £ 



1 — £0 V 1 — £ 



(C17) 



■\/l — K^ 



1 — eo /£i — £i 



1 - eo V 1 - 2ei 



Vl - K^ 



1 — £i / £o — £o 



1 - ei V 1 - 2eo 



£l — £l /£o — £o 



1 - 2£i V 1 - 2£o 



Similarly, a lower bound can be obtained by Eqs. (jC8 
ICTOllcfel) and (ICTSl) as 



(/3o|/3i 



>K 



V'7 


£o - 

-2£o 


£o 


/'7 


£l - 

-2£ 


£i 
1 




/I 

r 


-£o 
— z- 1 

-£o 


/f^ 


- 


- VT" 


-»% 


£l 
2ei 




/I 


-£l 


/f- 


~ 


- \/i~ 


-»% 


tu 


1 


— £l 


2eo 


[ei 


-£l 


£o — £o 





(C18) 



V 1 - 2£i V 1 - 2£o 

The explicit expression for c/ (e^,, e^;, k) is therefore given 
by Eq. (JCISP and respectively, c^ {£x j £a; i 't) is given by 
Eq. (ICTTl) . 



APPENDIX D: ESTIMATION TO THE OVERLAP 
OF EVE'S MAXIMAL EIGENSTATES 



(/3o|/3i 



>|C^oo||dl^oo| 






E ^^^^10 



1=1 



(C15) 



I Vol, 



E ^i^oV^^ 



feO 



fc=i 



E ^Wi^'^W^O 



fc,i=l 



In the collective attack scenario, Eve's attack can be 
modelled by attaching an ancilla system to the signals 
I ± a) and performing a unitary operation on the joint 
system. As any unitary preserves the inner product, the 
overlap |(^s£;|^b£;)| of the states after the interaction 
is given by input overlap |(— q;|q;)|. This can be written 
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|(-a|a)| = \{^U^],e)\ 



(Dl) 



= |v/(l-£o)(l-ei)(/3o|/3i)(eo|ei) 
+ V{l-£o)ei{Po\{£o\VEB) 

using decomposition ((39)) . where |'/5|;b) is orthogonal to 
|/3a:) Iex)- This orthogonaUty can be used to construct the 
inequaUties 

K^bI'Peb)]' + \{v>'EBmei)\' <l (D2) 

\{^%b\Veb)\' + m{S0\^'EB)f <^ ■ 

We can estimate the last three terms of the right hand 
side of Eq. (jDip using the triangle inequality and in- 
equalities (ID2P as 



(D3) 



|v/(l-eo)£i(/3o|(eo|'/?Bs) 



+ v/(l-ei)eo(¥'£Bl/3i>k~i) + 
+ y^(¥'£;Bl</'BS>l 



< 



^1 - \{^%s\^],sW{Va £o)ei + v/(l - £~i)eo) 



In the sixth line we have use fact the that if X^i ^1 = 
1, Yli^iVi — V^iVi holds, which can easily derived 
from the Cauchy-Schwarz inequality of two vectors in ]R^. 
From Eq. (|D3|) and Eq. ((DT|) . wc obtain 



> 



|(^o|^i)(eo|ei)| 

|(-a|a)| - y[^(l-£i)£o + v/(l-£o)£i]^ + £i£o 

v/(i-eo)(i-£Ty ■ 



and 



< 



|(/3o|/3i)(eo|ei)| 

\{~a\a)\ + ^y{l - ei)eo + ^(1 - ^oWi? + £i£o 
v/(l-eo)(l-eTy ■ 



l('^BBl'y5i;i3)l\/^ 



< V [V(l - £i)£o + V(l - eo)£i]2 + eieo 



Finally, we obtain Eqs. ()70II72|) by inserting the extremal 



(/?o|/3i 



of Bob's max- 



values for the possible overlaps 

imal eigenstates given by Eq. ([S7)) and the definition 

l-= l(eo|£i)|- 
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